xref: /openbmc/linux/net/sched/cls_flow.c (revision 6774def6)
1 /*
2  * net/sched/cls_flow.c		Generic flow classifier
3  *
4  * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  */
11 
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/jhash.h>
16 #include <linux/random.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/skbuff.h>
19 #include <linux/in.h>
20 #include <linux/ip.h>
21 #include <linux/ipv6.h>
22 #include <linux/if_vlan.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
25 
26 #include <net/pkt_cls.h>
27 #include <net/ip.h>
28 #include <net/route.h>
29 #include <net/flow_keys.h>
30 
31 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
32 #include <net/netfilter/nf_conntrack.h>
33 #endif
34 
35 struct flow_head {
36 	struct list_head	filters;
37 	struct rcu_head		rcu;
38 };
39 
40 struct flow_filter {
41 	struct list_head	list;
42 	struct tcf_exts		exts;
43 	struct tcf_ematch_tree	ematches;
44 	struct tcf_proto	*tp;
45 	struct timer_list	perturb_timer;
46 	u32			perturb_period;
47 	u32			handle;
48 
49 	u32			nkeys;
50 	u32			keymask;
51 	u32			mode;
52 	u32			mask;
53 	u32			xor;
54 	u32			rshift;
55 	u32			addend;
56 	u32			divisor;
57 	u32			baseclass;
58 	u32			hashrnd;
59 	struct rcu_head		rcu;
60 };
61 
62 static inline u32 addr_fold(void *addr)
63 {
64 	unsigned long a = (unsigned long)addr;
65 
66 	return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
67 }
68 
69 static u32 flow_get_src(const struct sk_buff *skb, const struct flow_keys *flow)
70 {
71 	if (flow->src)
72 		return ntohl(flow->src);
73 	return addr_fold(skb->sk);
74 }
75 
76 static u32 flow_get_dst(const struct sk_buff *skb, const struct flow_keys *flow)
77 {
78 	if (flow->dst)
79 		return ntohl(flow->dst);
80 	return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
81 }
82 
83 static u32 flow_get_proto(const struct sk_buff *skb, const struct flow_keys *flow)
84 {
85 	return flow->ip_proto;
86 }
87 
88 static u32 flow_get_proto_src(const struct sk_buff *skb, const struct flow_keys *flow)
89 {
90 	if (flow->ports)
91 		return ntohs(flow->port16[0]);
92 
93 	return addr_fold(skb->sk);
94 }
95 
96 static u32 flow_get_proto_dst(const struct sk_buff *skb, const struct flow_keys *flow)
97 {
98 	if (flow->ports)
99 		return ntohs(flow->port16[1]);
100 
101 	return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
102 }
103 
104 static u32 flow_get_iif(const struct sk_buff *skb)
105 {
106 	return skb->skb_iif;
107 }
108 
109 static u32 flow_get_priority(const struct sk_buff *skb)
110 {
111 	return skb->priority;
112 }
113 
114 static u32 flow_get_mark(const struct sk_buff *skb)
115 {
116 	return skb->mark;
117 }
118 
119 static u32 flow_get_nfct(const struct sk_buff *skb)
120 {
121 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
122 	return addr_fold(skb->nfct);
123 #else
124 	return 0;
125 #endif
126 }
127 
128 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
129 #define CTTUPLE(skb, member)						\
130 ({									\
131 	enum ip_conntrack_info ctinfo;					\
132 	const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);		\
133 	if (ct == NULL)							\
134 		goto fallback;						\
135 	ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member;			\
136 })
137 #else
138 #define CTTUPLE(skb, member)						\
139 ({									\
140 	goto fallback;							\
141 	0;								\
142 })
143 #endif
144 
145 static u32 flow_get_nfct_src(const struct sk_buff *skb, const struct flow_keys *flow)
146 {
147 	switch (skb->protocol) {
148 	case htons(ETH_P_IP):
149 		return ntohl(CTTUPLE(skb, src.u3.ip));
150 	case htons(ETH_P_IPV6):
151 		return ntohl(CTTUPLE(skb, src.u3.ip6[3]));
152 	}
153 fallback:
154 	return flow_get_src(skb, flow);
155 }
156 
157 static u32 flow_get_nfct_dst(const struct sk_buff *skb, const struct flow_keys *flow)
158 {
159 	switch (skb->protocol) {
160 	case htons(ETH_P_IP):
161 		return ntohl(CTTUPLE(skb, dst.u3.ip));
162 	case htons(ETH_P_IPV6):
163 		return ntohl(CTTUPLE(skb, dst.u3.ip6[3]));
164 	}
165 fallback:
166 	return flow_get_dst(skb, flow);
167 }
168 
169 static u32 flow_get_nfct_proto_src(const struct sk_buff *skb, const struct flow_keys *flow)
170 {
171 	return ntohs(CTTUPLE(skb, src.u.all));
172 fallback:
173 	return flow_get_proto_src(skb, flow);
174 }
175 
176 static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb, const struct flow_keys *flow)
177 {
178 	return ntohs(CTTUPLE(skb, dst.u.all));
179 fallback:
180 	return flow_get_proto_dst(skb, flow);
181 }
182 
183 static u32 flow_get_rtclassid(const struct sk_buff *skb)
184 {
185 #ifdef CONFIG_IP_ROUTE_CLASSID
186 	if (skb_dst(skb))
187 		return skb_dst(skb)->tclassid;
188 #endif
189 	return 0;
190 }
191 
192 static u32 flow_get_skuid(const struct sk_buff *skb)
193 {
194 	if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
195 		kuid_t skuid = skb->sk->sk_socket->file->f_cred->fsuid;
196 		return from_kuid(&init_user_ns, skuid);
197 	}
198 	return 0;
199 }
200 
201 static u32 flow_get_skgid(const struct sk_buff *skb)
202 {
203 	if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
204 		kgid_t skgid = skb->sk->sk_socket->file->f_cred->fsgid;
205 		return from_kgid(&init_user_ns, skgid);
206 	}
207 	return 0;
208 }
209 
210 static u32 flow_get_vlan_tag(const struct sk_buff *skb)
211 {
212 	u16 uninitialized_var(tag);
213 
214 	if (vlan_get_tag(skb, &tag) < 0)
215 		return 0;
216 	return tag & VLAN_VID_MASK;
217 }
218 
219 static u32 flow_get_rxhash(struct sk_buff *skb)
220 {
221 	return skb_get_hash(skb);
222 }
223 
224 static u32 flow_key_get(struct sk_buff *skb, int key, struct flow_keys *flow)
225 {
226 	switch (key) {
227 	case FLOW_KEY_SRC:
228 		return flow_get_src(skb, flow);
229 	case FLOW_KEY_DST:
230 		return flow_get_dst(skb, flow);
231 	case FLOW_KEY_PROTO:
232 		return flow_get_proto(skb, flow);
233 	case FLOW_KEY_PROTO_SRC:
234 		return flow_get_proto_src(skb, flow);
235 	case FLOW_KEY_PROTO_DST:
236 		return flow_get_proto_dst(skb, flow);
237 	case FLOW_KEY_IIF:
238 		return flow_get_iif(skb);
239 	case FLOW_KEY_PRIORITY:
240 		return flow_get_priority(skb);
241 	case FLOW_KEY_MARK:
242 		return flow_get_mark(skb);
243 	case FLOW_KEY_NFCT:
244 		return flow_get_nfct(skb);
245 	case FLOW_KEY_NFCT_SRC:
246 		return flow_get_nfct_src(skb, flow);
247 	case FLOW_KEY_NFCT_DST:
248 		return flow_get_nfct_dst(skb, flow);
249 	case FLOW_KEY_NFCT_PROTO_SRC:
250 		return flow_get_nfct_proto_src(skb, flow);
251 	case FLOW_KEY_NFCT_PROTO_DST:
252 		return flow_get_nfct_proto_dst(skb, flow);
253 	case FLOW_KEY_RTCLASSID:
254 		return flow_get_rtclassid(skb);
255 	case FLOW_KEY_SKUID:
256 		return flow_get_skuid(skb);
257 	case FLOW_KEY_SKGID:
258 		return flow_get_skgid(skb);
259 	case FLOW_KEY_VLAN_TAG:
260 		return flow_get_vlan_tag(skb);
261 	case FLOW_KEY_RXHASH:
262 		return flow_get_rxhash(skb);
263 	default:
264 		WARN_ON(1);
265 		return 0;
266 	}
267 }
268 
269 #define FLOW_KEYS_NEEDED ((1 << FLOW_KEY_SRC) | 		\
270 			  (1 << FLOW_KEY_DST) |			\
271 			  (1 << FLOW_KEY_PROTO) |		\
272 			  (1 << FLOW_KEY_PROTO_SRC) |		\
273 			  (1 << FLOW_KEY_PROTO_DST) | 		\
274 			  (1 << FLOW_KEY_NFCT_SRC) |		\
275 			  (1 << FLOW_KEY_NFCT_DST) |		\
276 			  (1 << FLOW_KEY_NFCT_PROTO_SRC) |	\
277 			  (1 << FLOW_KEY_NFCT_PROTO_DST))
278 
279 static int flow_classify(struct sk_buff *skb, const struct tcf_proto *tp,
280 			 struct tcf_result *res)
281 {
282 	struct flow_head *head = rcu_dereference_bh(tp->root);
283 	struct flow_filter *f;
284 	u32 keymask;
285 	u32 classid;
286 	unsigned int n, key;
287 	int r;
288 
289 	list_for_each_entry_rcu(f, &head->filters, list) {
290 		u32 keys[FLOW_KEY_MAX + 1];
291 		struct flow_keys flow_keys;
292 
293 		if (!tcf_em_tree_match(skb, &f->ematches, NULL))
294 			continue;
295 
296 		keymask = f->keymask;
297 		if (keymask & FLOW_KEYS_NEEDED)
298 			skb_flow_dissect(skb, &flow_keys);
299 
300 		for (n = 0; n < f->nkeys; n++) {
301 			key = ffs(keymask) - 1;
302 			keymask &= ~(1 << key);
303 			keys[n] = flow_key_get(skb, key, &flow_keys);
304 		}
305 
306 		if (f->mode == FLOW_MODE_HASH)
307 			classid = jhash2(keys, f->nkeys, f->hashrnd);
308 		else {
309 			classid = keys[0];
310 			classid = (classid & f->mask) ^ f->xor;
311 			classid = (classid >> f->rshift) + f->addend;
312 		}
313 
314 		if (f->divisor)
315 			classid %= f->divisor;
316 
317 		res->class   = 0;
318 		res->classid = TC_H_MAKE(f->baseclass, f->baseclass + classid);
319 
320 		r = tcf_exts_exec(skb, &f->exts, res);
321 		if (r < 0)
322 			continue;
323 		return r;
324 	}
325 	return -1;
326 }
327 
328 static void flow_perturbation(unsigned long arg)
329 {
330 	struct flow_filter *f = (struct flow_filter *)arg;
331 
332 	get_random_bytes(&f->hashrnd, 4);
333 	if (f->perturb_period)
334 		mod_timer(&f->perturb_timer, jiffies + f->perturb_period);
335 }
336 
337 static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
338 	[TCA_FLOW_KEYS]		= { .type = NLA_U32 },
339 	[TCA_FLOW_MODE]		= { .type = NLA_U32 },
340 	[TCA_FLOW_BASECLASS]	= { .type = NLA_U32 },
341 	[TCA_FLOW_RSHIFT]	= { .type = NLA_U32 },
342 	[TCA_FLOW_ADDEND]	= { .type = NLA_U32 },
343 	[TCA_FLOW_MASK]		= { .type = NLA_U32 },
344 	[TCA_FLOW_XOR]		= { .type = NLA_U32 },
345 	[TCA_FLOW_DIVISOR]	= { .type = NLA_U32 },
346 	[TCA_FLOW_ACT]		= { .type = NLA_NESTED },
347 	[TCA_FLOW_POLICE]	= { .type = NLA_NESTED },
348 	[TCA_FLOW_EMATCHES]	= { .type = NLA_NESTED },
349 	[TCA_FLOW_PERTURB]	= { .type = NLA_U32 },
350 };
351 
352 static void flow_destroy_filter(struct rcu_head *head)
353 {
354 	struct flow_filter *f = container_of(head, struct flow_filter, rcu);
355 
356 	del_timer_sync(&f->perturb_timer);
357 	tcf_exts_destroy(&f->exts);
358 	tcf_em_tree_destroy(&f->ematches);
359 	kfree(f);
360 }
361 
362 static int flow_change(struct net *net, struct sk_buff *in_skb,
363 		       struct tcf_proto *tp, unsigned long base,
364 		       u32 handle, struct nlattr **tca,
365 		       unsigned long *arg, bool ovr)
366 {
367 	struct flow_head *head = rtnl_dereference(tp->root);
368 	struct flow_filter *fold, *fnew;
369 	struct nlattr *opt = tca[TCA_OPTIONS];
370 	struct nlattr *tb[TCA_FLOW_MAX + 1];
371 	struct tcf_exts e;
372 	struct tcf_ematch_tree t;
373 	unsigned int nkeys = 0;
374 	unsigned int perturb_period = 0;
375 	u32 baseclass = 0;
376 	u32 keymask = 0;
377 	u32 mode;
378 	int err;
379 
380 	if (opt == NULL)
381 		return -EINVAL;
382 
383 	err = nla_parse_nested(tb, TCA_FLOW_MAX, opt, flow_policy);
384 	if (err < 0)
385 		return err;
386 
387 	if (tb[TCA_FLOW_BASECLASS]) {
388 		baseclass = nla_get_u32(tb[TCA_FLOW_BASECLASS]);
389 		if (TC_H_MIN(baseclass) == 0)
390 			return -EINVAL;
391 	}
392 
393 	if (tb[TCA_FLOW_KEYS]) {
394 		keymask = nla_get_u32(tb[TCA_FLOW_KEYS]);
395 
396 		nkeys = hweight32(keymask);
397 		if (nkeys == 0)
398 			return -EINVAL;
399 
400 		if (fls(keymask) - 1 > FLOW_KEY_MAX)
401 			return -EOPNOTSUPP;
402 
403 		if ((keymask & (FLOW_KEY_SKUID|FLOW_KEY_SKGID)) &&
404 		    sk_user_ns(NETLINK_CB(in_skb).sk) != &init_user_ns)
405 			return -EOPNOTSUPP;
406 	}
407 
408 	tcf_exts_init(&e, TCA_FLOW_ACT, TCA_FLOW_POLICE);
409 	err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
410 	if (err < 0)
411 		return err;
412 
413 	err = tcf_em_tree_validate(tp, tb[TCA_FLOW_EMATCHES], &t);
414 	if (err < 0)
415 		goto err1;
416 
417 	err = -ENOBUFS;
418 	fnew = kzalloc(sizeof(*fnew), GFP_KERNEL);
419 	if (!fnew)
420 		goto err2;
421 
422 	fold = (struct flow_filter *)*arg;
423 	if (fold) {
424 		err = -EINVAL;
425 		if (fold->handle != handle && handle)
426 			goto err2;
427 
428 		/* Copy fold into fnew */
429 		fnew->handle = fold->handle;
430 		fnew->keymask = fold->keymask;
431 		fnew->tp = fold->tp;
432 
433 		fnew->handle = fold->handle;
434 		fnew->nkeys = fold->nkeys;
435 		fnew->keymask = fold->keymask;
436 		fnew->mode = fold->mode;
437 		fnew->mask = fold->mask;
438 		fnew->xor = fold->xor;
439 		fnew->rshift = fold->rshift;
440 		fnew->addend = fold->addend;
441 		fnew->divisor = fold->divisor;
442 		fnew->baseclass = fold->baseclass;
443 		fnew->hashrnd = fold->hashrnd;
444 
445 		mode = fold->mode;
446 		if (tb[TCA_FLOW_MODE])
447 			mode = nla_get_u32(tb[TCA_FLOW_MODE]);
448 		if (mode != FLOW_MODE_HASH && nkeys > 1)
449 			goto err2;
450 
451 		if (mode == FLOW_MODE_HASH)
452 			perturb_period = fold->perturb_period;
453 		if (tb[TCA_FLOW_PERTURB]) {
454 			if (mode != FLOW_MODE_HASH)
455 				goto err2;
456 			perturb_period = nla_get_u32(tb[TCA_FLOW_PERTURB]) * HZ;
457 		}
458 	} else {
459 		err = -EINVAL;
460 		if (!handle)
461 			goto err2;
462 		if (!tb[TCA_FLOW_KEYS])
463 			goto err2;
464 
465 		mode = FLOW_MODE_MAP;
466 		if (tb[TCA_FLOW_MODE])
467 			mode = nla_get_u32(tb[TCA_FLOW_MODE]);
468 		if (mode != FLOW_MODE_HASH && nkeys > 1)
469 			goto err2;
470 
471 		if (tb[TCA_FLOW_PERTURB]) {
472 			if (mode != FLOW_MODE_HASH)
473 				goto err2;
474 			perturb_period = nla_get_u32(tb[TCA_FLOW_PERTURB]) * HZ;
475 		}
476 
477 		if (TC_H_MAJ(baseclass) == 0)
478 			baseclass = TC_H_MAKE(tp->q->handle, baseclass);
479 		if (TC_H_MIN(baseclass) == 0)
480 			baseclass = TC_H_MAKE(baseclass, 1);
481 
482 		fnew->handle = handle;
483 		fnew->mask  = ~0U;
484 		fnew->tp = tp;
485 		get_random_bytes(&fnew->hashrnd, 4);
486 		tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
487 	}
488 
489 	fnew->perturb_timer.function = flow_perturbation;
490 	fnew->perturb_timer.data = (unsigned long)fnew;
491 	init_timer_deferrable(&fnew->perturb_timer);
492 
493 	tcf_exts_change(tp, &fnew->exts, &e);
494 	tcf_em_tree_change(tp, &fnew->ematches, &t);
495 
496 	netif_keep_dst(qdisc_dev(tp->q));
497 
498 	if (tb[TCA_FLOW_KEYS]) {
499 		fnew->keymask = keymask;
500 		fnew->nkeys   = nkeys;
501 	}
502 
503 	fnew->mode = mode;
504 
505 	if (tb[TCA_FLOW_MASK])
506 		fnew->mask = nla_get_u32(tb[TCA_FLOW_MASK]);
507 	if (tb[TCA_FLOW_XOR])
508 		fnew->xor = nla_get_u32(tb[TCA_FLOW_XOR]);
509 	if (tb[TCA_FLOW_RSHIFT])
510 		fnew->rshift = nla_get_u32(tb[TCA_FLOW_RSHIFT]);
511 	if (tb[TCA_FLOW_ADDEND])
512 		fnew->addend = nla_get_u32(tb[TCA_FLOW_ADDEND]);
513 
514 	if (tb[TCA_FLOW_DIVISOR])
515 		fnew->divisor = nla_get_u32(tb[TCA_FLOW_DIVISOR]);
516 	if (baseclass)
517 		fnew->baseclass = baseclass;
518 
519 	fnew->perturb_period = perturb_period;
520 	if (perturb_period)
521 		mod_timer(&fnew->perturb_timer, jiffies + perturb_period);
522 
523 	if (*arg == 0)
524 		list_add_tail_rcu(&fnew->list, &head->filters);
525 	else
526 		list_replace_rcu(&fnew->list, &fold->list);
527 
528 	*arg = (unsigned long)fnew;
529 
530 	if (fold)
531 		call_rcu(&fold->rcu, flow_destroy_filter);
532 	return 0;
533 
534 err2:
535 	tcf_em_tree_destroy(&t);
536 	kfree(fnew);
537 err1:
538 	tcf_exts_destroy(&e);
539 	return err;
540 }
541 
542 static int flow_delete(struct tcf_proto *tp, unsigned long arg)
543 {
544 	struct flow_filter *f = (struct flow_filter *)arg;
545 
546 	list_del_rcu(&f->list);
547 	call_rcu(&f->rcu, flow_destroy_filter);
548 	return 0;
549 }
550 
551 static int flow_init(struct tcf_proto *tp)
552 {
553 	struct flow_head *head;
554 
555 	head = kzalloc(sizeof(*head), GFP_KERNEL);
556 	if (head == NULL)
557 		return -ENOBUFS;
558 	INIT_LIST_HEAD(&head->filters);
559 	rcu_assign_pointer(tp->root, head);
560 	return 0;
561 }
562 
563 static void flow_destroy(struct tcf_proto *tp)
564 {
565 	struct flow_head *head = rtnl_dereference(tp->root);
566 	struct flow_filter *f, *next;
567 
568 	list_for_each_entry_safe(f, next, &head->filters, list) {
569 		list_del_rcu(&f->list);
570 		call_rcu(&f->rcu, flow_destroy_filter);
571 	}
572 	RCU_INIT_POINTER(tp->root, NULL);
573 	kfree_rcu(head, rcu);
574 }
575 
576 static unsigned long flow_get(struct tcf_proto *tp, u32 handle)
577 {
578 	struct flow_head *head = rtnl_dereference(tp->root);
579 	struct flow_filter *f;
580 
581 	list_for_each_entry_rcu(f, &head->filters, list)
582 		if (f->handle == handle)
583 			return (unsigned long)f;
584 	return 0;
585 }
586 
587 static void flow_put(struct tcf_proto *tp, unsigned long f)
588 {
589 }
590 
591 static int flow_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
592 		     struct sk_buff *skb, struct tcmsg *t)
593 {
594 	struct flow_filter *f = (struct flow_filter *)fh;
595 	struct nlattr *nest;
596 
597 	if (f == NULL)
598 		return skb->len;
599 
600 	t->tcm_handle = f->handle;
601 
602 	nest = nla_nest_start(skb, TCA_OPTIONS);
603 	if (nest == NULL)
604 		goto nla_put_failure;
605 
606 	if (nla_put_u32(skb, TCA_FLOW_KEYS, f->keymask) ||
607 	    nla_put_u32(skb, TCA_FLOW_MODE, f->mode))
608 		goto nla_put_failure;
609 
610 	if (f->mask != ~0 || f->xor != 0) {
611 		if (nla_put_u32(skb, TCA_FLOW_MASK, f->mask) ||
612 		    nla_put_u32(skb, TCA_FLOW_XOR, f->xor))
613 			goto nla_put_failure;
614 	}
615 	if (f->rshift &&
616 	    nla_put_u32(skb, TCA_FLOW_RSHIFT, f->rshift))
617 		goto nla_put_failure;
618 	if (f->addend &&
619 	    nla_put_u32(skb, TCA_FLOW_ADDEND, f->addend))
620 		goto nla_put_failure;
621 
622 	if (f->divisor &&
623 	    nla_put_u32(skb, TCA_FLOW_DIVISOR, f->divisor))
624 		goto nla_put_failure;
625 	if (f->baseclass &&
626 	    nla_put_u32(skb, TCA_FLOW_BASECLASS, f->baseclass))
627 		goto nla_put_failure;
628 
629 	if (f->perturb_period &&
630 	    nla_put_u32(skb, TCA_FLOW_PERTURB, f->perturb_period / HZ))
631 		goto nla_put_failure;
632 
633 	if (tcf_exts_dump(skb, &f->exts) < 0)
634 		goto nla_put_failure;
635 #ifdef CONFIG_NET_EMATCH
636 	if (f->ematches.hdr.nmatches &&
637 	    tcf_em_tree_dump(skb, &f->ematches, TCA_FLOW_EMATCHES) < 0)
638 		goto nla_put_failure;
639 #endif
640 	nla_nest_end(skb, nest);
641 
642 	if (tcf_exts_dump_stats(skb, &f->exts) < 0)
643 		goto nla_put_failure;
644 
645 	return skb->len;
646 
647 nla_put_failure:
648 	nlmsg_trim(skb, nest);
649 	return -1;
650 }
651 
652 static void flow_walk(struct tcf_proto *tp, struct tcf_walker *arg)
653 {
654 	struct flow_head *head = rtnl_dereference(tp->root);
655 	struct flow_filter *f;
656 
657 	list_for_each_entry_rcu(f, &head->filters, list) {
658 		if (arg->count < arg->skip)
659 			goto skip;
660 		if (arg->fn(tp, (unsigned long)f, arg) < 0) {
661 			arg->stop = 1;
662 			break;
663 		}
664 skip:
665 		arg->count++;
666 	}
667 }
668 
669 static struct tcf_proto_ops cls_flow_ops __read_mostly = {
670 	.kind		= "flow",
671 	.classify	= flow_classify,
672 	.init		= flow_init,
673 	.destroy	= flow_destroy,
674 	.change		= flow_change,
675 	.delete		= flow_delete,
676 	.get		= flow_get,
677 	.put		= flow_put,
678 	.dump		= flow_dump,
679 	.walk		= flow_walk,
680 	.owner		= THIS_MODULE,
681 };
682 
683 static int __init cls_flow_init(void)
684 {
685 	return register_tcf_proto_ops(&cls_flow_ops);
686 }
687 
688 static void __exit cls_flow_exit(void)
689 {
690 	unregister_tcf_proto_ops(&cls_flow_ops);
691 }
692 
693 module_init(cls_flow_init);
694 module_exit(cls_flow_exit);
695 
696 MODULE_LICENSE("GPL");
697 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
698 MODULE_DESCRIPTION("TC flow classifier");
699